Splunk Dev

Alert Setup

sayashagarwal27
New Member

Alert should trigger each time if count of event is less 10 in last 30 min. But it will aggregate alerts if count is more than 10 in last 30 min

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So if two events occur every 30 minutes then you want two alerts triggered and if 11 events occur then you want a single alert, correct?  If so then Splunk does not throttle alerts that way.  Go to https://ideas.splunk.com to suggest Splunk offer it.

If that is not what you seek then please describe the problem more.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...